att-redirection[.]weeblysite[.]com

The domain att-redirection.weeblysite.com was observed hosting a page titled “Home | Att Redirection”. The site is listed on a single security blocklist and was blocked by PhishDestroy. Google Safe Browsing classifies the URL as social engineering, and VirusTotal recorded 14 detections out of 95 scanned scanners, indicating a moderate to high confidence of malicious intent. The domain resolves to IP 74.115.51.54, which belongs to AS27647 Weebly, Inc. and is located in the United States.

The hosting infrastructure uses Amazon Web Services and is fronted by Cloudflare, while the TLS certificate is issued by Google Trust Services under the “WE1” designation, suggesting a legitimate‑looking HTTPS connection. A HTTP request returns a 404 status, meaning the original content is no longer reachable, and the current operational status is marked as offline. The domain was created on 19 December 2012 and is registered through Safenames Ltd. The page title and the explicit “impersonates AT&T” label indicate a brand‑impersonation campaign targeting AT&T customers, although no additional content details have been captured. Uncertainty remains around the exact phishing kit or credential‑collection mechanism because the site is no longer serving content and no screenshots are available.

The presence of a valid TLS certificate and Cloudflare front‑end may have been used to increase user trust, but the 404 response limits immediate forensic analysis of the payload. Defenders should continue to block the domain at perimeter filters, update URL reputation feeds with the observed indicators, and monitor for any resurgence of the same host or similar subdomains under the Weebly hosting provider. Threat hunters should query the IP address and the four listed nameservers (ns-1375.awsdns-43.org, ns-1854.awsdns-39.co.uk, ns-510.awsdns-63.com, ns-522.